CVE-2004-0869

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securityfocus.com/archive/1/375407Vendor Advisory
http://securitytracker.com/id?1011332
http://www.westpoint.ltd.uk/advisories/wp-04-0001.txtExploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17417
http://securityfocus.com/archive/1/375407Vendor Advisory
http://securitytracker.com/id?1011332
http://www.westpoint.ltd.uk/advisories/wp-04-0001.txtExploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17417

Timeline

Published: Sep 16, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-08705.0KDE Konqueror does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) CVE-2004-08715.0Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the CVE-2004-08725.0Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the s CVE-2004-08737.5Apple iChat AV 2.1, AV 2.0, and 1.0.1 allows remote attackers to execute arbitrary programs via a "link" that references the program.CVE-2004-08756.8Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware (aka webdistro) 0.9.16.002 and earlier allow remote attackers to insert CVE-2004-08801.2getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file.CVE-2004-08812.1getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to write files in arbitrary directories via CVE-2004-088210.0Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a CVE-2004-08836.4Multiple vulnerabilities in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 allow remote samba servers to cause a denial of service CVE-2004-08847.2The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available S CVE-2004-08857.5The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remot CVE-2004-08865.0Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via